Extracted

• • Target
    e174a635f26565fd71a445b02e1cf1c923b686a900ce9f98312f5ebdf8d6d9b3
  • Size 45KB
  • SHA256 e174a635f26565fd71a445b02e1cf1c923b686a900ce9f98312f5ebdf8d6d9b3
  • MD5 281408414ebfe58dcad5db9352bb5443
  • SHA1 4dcadd2f411e3faf18d350ecb1500df1d2a12c8d
  • SHA512 d9d6dae8cbd151791b99b681547fe5ec8a1485c4d6cb74b5c2620a65f1230ebcb8fe9613a5231c8d83a88ed1fbdd4582eefff7bcd56a4f6c9d5b0fe7d7b67e94
  • SSDEEP 768:5uSy6pTpwrSWWUE3/WImo2qN9O5QyCBjHSNjPIwzjb3gX3iMT8v6/cMmHeBDZ0x:5uSy6pTpoo2MO59ESKw3bQXSK0indd0x
  • TLSH
    T134233C003BE9812BF2BE4F78A8F26145867AF2637603D5492CC452DB5613FC696436FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultdefense_evasiondiscoveryexecutionasyncratpersistenceratcommand_and_control

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2